mediumMultiple Choice
Most Critical Risk in Unsupported Legacy Systems: Unpatched Vulnerabilities
A company operates a legacy system for which the vendor no longer provides security patches. What is the most critical risk to identify regarding this system?
Quick Answer
The answer is unpatched vulnerabilities. This is the most critical risk because a legacy system without vendor support has no mechanism to remediate known security flaws, leaving it exposed to published CVEs that attackers can exploit directly. On the CRISC exam, this concept tests your ability to prioritize risk in the context of end-of-life systems, where the absence of patches creates a permanent attack surface that threatens confidentiality, integrity, and availability. A common trap is focusing on functional obsolescence or compliance gaps, but the exam emphasizes that unpatched vulnerabilities represent an active, exploitable threat. Remember the memory tip: "No patch, no parachute"—without vendor updates, the system has no safety net against known exploits, making unpatched vulnerabilities the single highest-priority risk to identify.
⚠ Common exam trap
Test-takers frequently confuse the root cause (lack of vendor support) with the actual risk (unpatched vulnerabilities), leading them to select 'Lack of vendor support' instead of identifying the direct security exposure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Unpatched vulnerabilities
Unpatched vulnerabilities are the most critical risk because the legacy system is exposed to known exploits that the vendor no longer addresses. Without security patches, attackers can leverage published CVEs to compromise the system, leading to data breaches or system takeover. This directly threatens the confidentiality, integrity, and availability of the system and its data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Unpatched vulnerabilities
Why this is correct
Without vendor patches, known exploits remain permanently exploitable, so unpatched vulnerabilities represent the most critical risk. This directly addresses the stem's constraint that no security patches are available, unlike availability, compliance or obsolescence concerns that follow from, rather than define, that exposure.
- ✗
Incompatibility with new systems
Why it's wrong here
Incompatibility with newer systems is an integration and operational concern, not the exposure created by absent patches. It would be the priority risk when planning upgrades or migrations, but the stem's missing security fixes leave exploitable vulnerabilities as the critical risk.
- ✗
Lack of vendor support
Why it's wrong here
Lack of vendor support is the underlying cause already stated in the stem, so it restates the condition rather than the risk arising from it. It would be the correct answer if the question asked why patches are unavailable, not what risk the unpatched system creates.
- ✗
Skill shortage for maintenance
Why it's wrong here
A skill shortage affects maintenance capability and cost, but does not itself expose the system to exploitation. It would be the leading risk where knowledge of an ageing platform is concentrated in few staff, yet the stem's absent patches leave unmitigated vulnerabilities as the critical exposure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CRISC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A retail company uses a legacy inventory system that is no longer supported by the vendor. The IT department is planning to migrate to a modern cloud-based system. During risk identification, which of the following should be considered a PRIMARY risk?
easy- A.Inadequate training of staff on the new system.
- B.Potential cost overrun due to migration complexity.
- ✓ C.Loss of data integrity during the data migration process.
- D.Failure to decommission the legacy system after migration.
Why C: Loss of data integrity during migration is the primary risk because the legacy system is unsupported, meaning there are no vendor patches or tools to validate or repair data inconsistencies. Corrupted or incomplete data transferred to the cloud-based system can lead to inaccurate inventory records, financial losses, and operational disruptions that are difficult to reverse without vendor support.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.